From 4643a4107adc17e156396227d1975569b15c84f3 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 16:11:34 +0200 Subject: [PATCH 1/3] docs: disable KVM nested virtualization in Talos install configs (CVE-2026-53359) Add kvm_intel.nested=0 and kvm_amd.nested=0 to machine.install.extraKernelArgs in the Talos install machine-config examples across all docs versions, to mitigate CVE-2026-53359 (Januscape), a KVM guest-to-host escape reachable only when nested virtualization is exposed to the guest. Signed-off-by: Andrei Kvapil Assisted-By: Claude --- content/en/docs/next/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/next/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v0/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v0/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.0/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.1/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.2/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.3/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.4/install/kubernetes/talosctl.md | 4 ++++ content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md | 4 ++++ content/en/docs/v1.5/install/kubernetes/talosctl.md | 4 ++++ 16 files changed, 64 insertions(+) diff --git a/content/en/docs/next/install/kubernetes/talos-bootstrap.md b/content/en/docs/next/install/kubernetes/talos-bootstrap.md index 1678b79e..a568ab6e 100644 --- a/content/en/docs/next/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/next/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/next/install/kubernetes/talosctl.md b/content/en/docs/next/install/kubernetes/talosctl.md index 7e9adc94..f4a8433f 100644 --- a/content/en/docs/next/install/kubernetes/talosctl.md +++ b/content/en/docs/next/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md index 267e61b4..aee4a4a8 100644 --- a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md @@ -69,6 +69,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v0/install/kubernetes/talosctl.md b/content/en/docs/v0/install/kubernetes/talosctl.md index 32a6dbf8..3d56452a 100644 --- a/content/en/docs/v0/install/kubernetes/talosctl.md +++ b/content/en/docs/v0/install/kubernetes/talosctl.md @@ -89,6 +89,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md index 479fe9bc..98fb2cb3 100644 --- a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talosctl.md b/content/en/docs/v1.0/install/kubernetes/talosctl.md index 4675df1e..18ef90b7 100644 --- a/content/en/docs/v1.0/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.0/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md index b380163f..945f60b3 100644 --- a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talosctl.md b/content/en/docs/v1.1/install/kubernetes/talosctl.md index 3cf1b41a..24633032 100644 --- a/content/en/docs/v1.1/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.1/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md index 19272544..a7597117 100644 --- a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talosctl.md b/content/en/docs/v1.2/install/kubernetes/talosctl.md index 0f451543..439013f0 100644 --- a/content/en/docs/v1.2/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.2/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md index bc7b4743..697bd8e5 100644 --- a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.3/install/kubernetes/talosctl.md b/content/en/docs/v1.3/install/kubernetes/talosctl.md index c3782f42..8ff9d124 100644 --- a/content/en/docs/v1.3/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.3/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md index 297d6974..8a2cfbde 100644 --- a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.4/install/kubernetes/talosctl.md b/content/en/docs/v1.4/install/kubernetes/talosctl.md index 1461d23b..2669c3d7 100644 --- a/content/en/docs/v1.4/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.4/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md index da3ae158..e11575da 100644 --- a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,10 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.5/install/kubernetes/talosctl.md b/content/en/docs/v1.5/install/kubernetes/talosctl.md index 046bd12b..0acc569e 100644 --- a/content/en/docs/v1.5/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.5/install/kubernetes/talosctl.md @@ -85,6 +85,10 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + extraKernelArgs: + # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) + - kvm_intel.nested=0 + - kvm_amd.nested=0 registries: mirrors: docker.io: From 642dbb2a8b98acd7457f5e582cdfb8ee0579341b Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 20:25:58 +0200 Subject: [PATCH 2/3] docs: pin grubUseUKICmdline=false for Talos >=1.12 so kvm nested args apply (CVE-2026-53359) extraKernelArgs is rejected/ignored under the UKI cmdline on Talos >=1.12; pin grubUseUKICmdline=false in the >=1.12 docs (next, v1.3-v1.5) so the mitigation actually takes effect. Signed-off-by: Andrei Kvapil Assisted-By: Claude --- content/en/docs/next/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/next/install/kubernetes/talosctl.md | 3 +++ content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/v1.3/install/kubernetes/talosctl.md | 3 +++ content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/v1.4/install/kubernetes/talosctl.md | 3 +++ content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md | 3 +++ content/en/docs/v1.5/install/kubernetes/talosctl.md | 3 +++ 8 files changed, 24 insertions(+) diff --git a/content/en/docs/next/install/kubernetes/talos-bootstrap.md b/content/en/docs/next/install/kubernetes/talos-bootstrap.md index a568ab6e..cf6f8853 100644 --- a/content/en/docs/next/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/next/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/next/install/kubernetes/talosctl.md b/content/en/docs/next/install/kubernetes/talosctl.md index f4a8433f..f8c1f9ee 100644 --- a/content/en/docs/next/install/kubernetes/talosctl.md +++ b/content/en/docs/next/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md index 697bd8e5..e64e7280 100644 --- a/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.3/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.3/install/kubernetes/talosctl.md b/content/en/docs/v1.3/install/kubernetes/talosctl.md index 8ff9d124..600254c4 100644 --- a/content/en/docs/v1.3/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.3/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md index 8a2cfbde..cfffa40b 100644 --- a/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.4/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.4/install/kubernetes/talosctl.md b/content/en/docs/v1.4/install/kubernetes/talosctl.md index 2669c3d7..7e2fc4cd 100644 --- a/content/en/docs/v1.4/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.4/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md index e11575da..40d6db60 100644 --- a/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.5/install/kubernetes/talos-bootstrap.md @@ -65,6 +65,9 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 diff --git a/content/en/docs/v1.5/install/kubernetes/talosctl.md b/content/en/docs/v1.5/install/kubernetes/talosctl.md index 0acc569e..a89ee9f8 100644 --- a/content/en/docs/v1.5/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.5/install/kubernetes/talosctl.md @@ -85,6 +85,9 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:{{< version-pin "talos" >}} + # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the + # Talos-built cmdline (Talos rejects/ignores extraKernelArgs under UKI). + grubUseUKICmdline: false extraKernelArgs: # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - kvm_intel.nested=0 From a593dc65e13353d1725757ceacd63e182e5279f7 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 20:58:14 +0200 Subject: [PATCH 3/3] docs: drop nested-virt args from pre-1.12 install guides (CVE-2026-53359) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Talos <1.12 machine.install.extraKernelArgs is a no-op on UEFI/UKI nodes and grubUseUKICmdline does not exist to opt out, so the snippet did nothing on modern hardware. Remove it from the v0-v1.2 guides (Talos v1.10.3); ≥1.12 guides keep the working grubUseUKICmdline=false + extraKernelArgs form. Signed-off-by: Andrei Kvapil Assisted-By: Claude --- content/en/docs/v0/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v0/install/kubernetes/talosctl.md | 4 ---- content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v1.0/install/kubernetes/talosctl.md | 4 ---- content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v1.1/install/kubernetes/talosctl.md | 4 ---- content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md | 4 ---- content/en/docs/v1.2/install/kubernetes/talosctl.md | 4 ---- 8 files changed, 32 deletions(-) diff --git a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md index aee4a4a8..267e61b4 100644 --- a/content/en/docs/v0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v0/install/kubernetes/talos-bootstrap.md @@ -69,10 +69,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v0/install/kubernetes/talosctl.md b/content/en/docs/v0/install/kubernetes/talosctl.md index 3d56452a..32a6dbf8 100644 --- a/content/en/docs/v0/install/kubernetes/talosctl.md +++ b/content/en/docs/v0/install/kubernetes/talosctl.md @@ -89,10 +89,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md index 98fb2cb3..479fe9bc 100644 --- a/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.0/install/kubernetes/talos-bootstrap.md @@ -65,10 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.0/install/kubernetes/talosctl.md b/content/en/docs/v1.0/install/kubernetes/talosctl.md index 18ef90b7..4675df1e 100644 --- a/content/en/docs/v1.0/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.0/install/kubernetes/talosctl.md @@ -85,10 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md index 945f60b3..b380163f 100644 --- a/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.1/install/kubernetes/talos-bootstrap.md @@ -65,10 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.1/install/kubernetes/talosctl.md b/content/en/docs/v1.1/install/kubernetes/talosctl.md index 24633032..3cf1b41a 100644 --- a/content/en/docs/v1.1/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.1/install/kubernetes/talosctl.md @@ -85,10 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md index a7597117..19272544 100644 --- a/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md +++ b/content/en/docs/v1.2/install/kubernetes/talos-bootstrap.md @@ -65,10 +65,6 @@ talos-bootstrap --help - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: diff --git a/content/en/docs/v1.2/install/kubernetes/talosctl.md b/content/en/docs/v1.2/install/kubernetes/talosctl.md index 439013f0..0f451543 100644 --- a/content/en/docs/v1.2/install/kubernetes/talosctl.md +++ b/content/en/docs/v1.2/install/kubernetes/talosctl.md @@ -85,10 +85,6 @@ Discovered open port 50000/tcp on 192.168.123.13 - name: vfio_iommu_type1 install: image: ghcr.io/cozystack/cozystack/talos:v1.10.3 - extraKernelArgs: - # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation) - - kvm_intel.nested=0 - - kvm_amd.nested=0 registries: mirrors: docker.io: